Conditional Entropy for Deception Analysis, 13th ICCRTS: C2 for Complex Endeavors

Abstract

This paper describes how basic concepts from information theory can be used to analyze deception. We show how a general definition of deception can be mapped to a simple communication model known as a Z-channel, and we show that any deception has associated with it a closely related deception we call it’s symmetric complement. These ideas allow computation of a specific form of conditional entropy which indicates the average uncertainty, in bits, that a deception imposes on a deception target. This uncertainty provides unique and general insight into a deceptions performance, and also indicates the general counter-deception potential available to a deception target. We then describe two deception-based mechanisms for computer security: the fake honeypot serves to inoculate a computer against intrusions; and the spoofing channel provides a safe and effective means for responding to in-progress computer intrusions. The spoofing channel is of fundamental interest because it is a deception equal to its symmetric complement.